According to Security NEXT, on October 28, 2026, Yamaha disclosed two vulnerabilities in its NWR100 wireless routers and released fixed firmware [1]. CVE-2026-97854 is an OS command injection vulnerability in which specially crafted requests could trigger program execution or configuration changes [1]. CVE-2026-109822 allows an unauthenticated attacker to read exported configuration files; JVN assigned CVSS v4.0 scores of 9.3 and 7.1, respectively [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Two Vulnerabilities in Yamaha NWR100 Routers Could Allow Command Execution or Configuration Disclosure
1 min read
- Disclosed
- Oct 30, 2026
- Published
- Nov 10, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- [1]
- 1.4%, higher than 72% of CVEs
- Attack vector
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology
What to do nowOur advice
CVE-2026-109822 allows an unauthenticated attacker to read exported configuration files; JVN assigned CVSS v4.0 scores of 9.3 and 7.1, respectively [1].
Timeline
- Security NEXT publishes report (date only; timestamp is a placeholder)[1]
Technical details
Verified Source Summary
On October 28, 2026, Yamaha disclosed two vulnerabilities in its NWR100 wireless routers and released fixed firmware [1].
CVE-2026-97854 is an OS command injection vulnerability in which specially crafted requests could trigger program execution or configuration changes [1].
CVE-2026-109822 allows an unauthenticated attacker to read exported configuration files; JVN assigned v4.0 scores of 9.3 and 7.1, respectively [1].
References
Media1
- [1]
“ヤマハの無線LANルータ「NWR100」に複数の脆弱性が判明した。任意のOSコマンドを実行されたり、設定情報が漏洩するおそれがあり、同社はファームウェアの修正版を公開している。”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.